Use Pulumi to create Entra applications

[jemrobinson]

✅ Checklist

• You have given your pull request a meaningful title (e.g. Enable foobar integration rather than 515 foobar).
• You are targeting the appropriate branch. If you're not certain which one this is, it should be develop.
• Your branch is up-to-date with the target branch (it probably was when you started, but it may have changed since then).

🚦 Depends on

n/a

⤴️ Summary

Replace creation of SRE Entra applications through the SDK with creation through pulumi-azuread.

Note we still need one SDK-created Entra application in the SHM which is used to authenticate pulumi-azuread.

The msgraph_permissions map looks up the GUIDs for all possible permissions. We could consider replacing this with a static lookup table that only covers the ones we need.

🌂 Related issues

Closes #2215

🔬 Tests

Tested on a fresh SRE deployment

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
data_safe_haven/commands
pulumi.py
sre.py
data_safe_haven/external/api
credentials.py
graph_api.py
data_safe_haven/infrastructure
project_manager.py
data_safe_haven/infrastructure/components/composite
__init__.py
entra_application.py					23-30, 53, 78, 102-150
data_safe_haven/infrastructure/components/dynamic
__init__.py
data_safe_haven/infrastructure/programs
declarative_sre.py					156
data_safe_haven/infrastructure/programs/sre
entra.py					28-30, 43-47, 57-124
identity.py					39-40
remote_desktop.py					58-59
data_safe_haven/provisioning
sre_provisioning_manager.py
data_safe_haven/types
enums.py
Project Total

This report was generated by python-coverage-comment-action